Veza

Overview

Veza builds an access graph that maps identities to the data and systems they can actually reach, framing identity governance (IGA) around effective permissions rather than the roles nominally assigned. Founded in 2020, it targets the question security teams most struggle to answer across a sprawling estate: who can truly access what, and how.

ServiceNow announced the acquisition on 2 December 2025 and closed it on 2 March 2026 for approximately 1.2 billion dollars, substantially in cash. The access graph now backs ServiceNow AI Control Tower, governing what AI agents can reach. Veza sold well as a neutral visibility layer over an incumbent such as SailPoint or Saviynt, and that neutrality is harder to hold inside a platform with its own governance ambitions. Check licensing at renewal: see the news item.

What it is good at

The authorization graph is the standout. Veza resolves the real, effective permissions an identity holds across cloud, SaaS, and data stores, cutting through nested roles, groups, and policies to show actual access. That precision is excellent for access intelligence, least-privilege cleanup, and evidence-grade certifications, and it covers non-human and service identities that traditional IGA often misses.

Where it falls short

Veza has moved past pure visibility. Its site (checked 2026-11-05) now markets Lifecycle Management, Access Requests, Access Reviews and Separation of Duties, and the Lifecycle Management page describes joiner, mover and leaver workflows anchored to HR, payroll, ITSM and IdP sources, birthright access, native connectors for Microsoft, AWS, Google, Salesforce, Oracle and Okta, SCIM apps, and write-back to custom apps through its OAA Write framework, with a dry-run mode. These modules are younger than the provisioning engines of the established suites, so large estates with deep legacy and on-premises targets should test connector coverage before replacing an incumbent rather than assume parity. It is an enterprise tool with quote-based pricing, not a lightweight or low-cost option, and authentication and MFA are outside its scope by design.

Pricing

Enterprise subscription, quote-based. Model it against full-lifecycle IGA suites with the TCO calculator.

Best for, and who should look elsewhere

Choose Veza when deep, cross-system access visibility is the priority, and evaluate its newer lifecycle and request modules if you want that graph to drive provisioning too. For the full lifecycle, compare Veza vs SailPoint and SailPoint vs Saviynt; for modern access reviews and JIT, see ConductorOne.

Bottom line

A leading choice when precise visibility into effective access is the priority, now owned by ServiceNow and growing into lifecycle and access requests, though most large estates still run it alongside an established provisioning IGA.